Here's an explanation of how Certik attacked Kracken's deposits: https://x.com/danielvf/status/1803780167027871878 https://x.com/danielvf/status/18037801670278

Here's an explanation of how Certik attacked Kracken's deposits: https://x.com/danielvf/status/1803780167027871878 https://x.com/danielvf/status/1803780167027871878 Certik did hard work to find the bug - testing many of exchanges over many blockchains. But everything after finding that was firmly in crazy land. Waiting multiple days to disclose, stealing 3 million dollars, swapping the stolen coins to coins, laundering some of the theft through OFAC sanctioned entities, and then not even returning the exact amounts they took is just mind boggling, and that only after public pressure. And then, to take it to the next level, tweeting over and over again once Kraken disclosed that a vulnerability had been reveled, grabbing credit for being evil, posting timelines of crimes, and insisting that they were the victim. It's amazing. In a serious world, this would be an amazing example of what to never do as a social team.